Yes - you can do the filter as you mentioned. I've used that to good effect with several customers.
Unfortunately you don't have the ability to run scheduled reports like we could with LMS. I and others have complaiend bitterly to cisco at various forums about this feature gap to no avail.
They seem to have been more engaged in building in things like iWAN and ZTP support which almost nobody uses (except - I suspect - maybe a few VIP customers).
PI 3.2 is due out any day - though I wouldn't hold my breath expecting it to fix 5 years of feature gap.
Personally I would recommend several other Syslog products before PI - the paid Kiwi syslog server from SolarWinds is noce. I've also heard good things about Graylog and ELK though some assembly may be required. :)
https://medium.com/jetruby/log-management-graylog-vs-elk-fc93428e0f66
https://www.reddit.com/r/devops/comments/50wf7b/whether_to_use_graylog_vs_elk_stack/